KR20240151901A - System for monitoring and auditing web application and method thereof - Google Patents

Abstract

The present invention relates to a web application monitoring and auditing system and method, and includes a user terminal which operates a web application, accesses a web application server, and processes data changes; a web application server which operates an application, manages data input from the web application and accessed user session information, and matches and stores the session information of the web application server with the session information of a database management system server; a database management system server which extracts audit information from data change information based on the session information of the database management system server which matches the session information of the web application server; a performance information monitoring server which collects web application performance information and database management system server performance information from the web application server and the database management system server, and monitors them against preset performance criteria; and an audit information management server which collects data change information from the database management system server, stores the change history, and monitors violations of preset audit regulation criteria with respect to the audit information.

Description

{System for monitoring and auditing web application and method thereof}

The present invention relates to a web application monitoring and auditing system and method, and more particularly, to a technology for monitoring the performance of a web application and managing data change history by linking session information of a web application server and a database management system. The web application monitoring and auditing system through linking a web application server (WAS) session and a database management system server (DBMS) session enables performance monitoring and confirmation of data manipulation by matching a WAS session and a DBMS session related to a specific transaction of a WAS in a web-based structure including one or more WASs and one or more DBMSs.

The Ostem Implant embezzlement case that occurred at the end of 2021 was an accounting fraud case that occurred by manipulating an internal database.

This incident highlighted the need for technology to detect alterations in accounting data and notify of violations of standards to prevent accounting fraud.

Most accounting systems today access data by connecting to a database management system server (DBMS) through a web application server (WAS).

WAS functions as a middleware that supports linkage between user applications implemented on the web and DBMS that manages business data, and provides functions for system security and stability, as well as configuration of various web infrastructures and improvement of service speed.

DBMS is a program that allows multiple users to record or access data in a database, and uses SQL (Structure Query Language) as a user and program interface to allow users to utilize required data.

In the case of IT systems using WAS and DBMS, data changers access data through WAS, and the DBMS cannot obtain information about the actual data changer.

To solve this problem, a technology is needed to store information about users who are actually connected to the WAS session and transmit it to the DBMS.

In addition, due to the increase in IT services and data caused by the 4th industrial revolution, data within IT systems is exploding and its flow is becoming more complex.

To respond to this, the adoption of microservice architecture (hereinafter referred to as MSA) is expanding, and the adoption of MSA technology requires a change in the performance monitoring method of IT services.

Accordingly, a technology is needed to provide linked performance information, moving away from the method in which performance information within WAS and DBMS was provided independently.

Domestic registration patent No. 10-0906440

The present invention has been made to solve the conventional problems of data change management and performance monitoring as described above, and its purpose is to provide information for auditing by matching WAS session and DBMS session information, and to provide detailed performance information.

In addition, the present invention provides a method for notifying the risk of data manipulation or modification by detecting a situation that deviates from a specific standard specified by a user through a performance monitoring and auditing system of a web application.

The web application monitoring and auditing system according to the present invention is a system for monitoring the performance of a web application by linking web application server session information and database management system server session information, and managing data change history to provide audit information, characterized in that it includes: a user terminal for operating a web application, accessing a web application server, and processing data changes; a web application server for operating an application, managing data input from the web application and accessed user session information, and matching and storing the session information of the web application server with the session information of the database management system server; a database management system server for extracting audit information from the data change information based on the session information of the database management system server matching the session information of the web application server; a performance information monitoring server for collecting and storing web application performance information and database management system server performance information from the web application server and the database management system server, and monitoring the stored information by comparing it with a preset performance standard; and an audit information management server for collecting data change information from the database management system server, storing the change history as audit information, and monitoring violations of preset audit regulation standards for the stored audit information.

In addition, in the web application monitoring and auditing system according to the present invention, the web application server is characterized in that it includes a web application server agent for extracting and storing user access information connected to the web application server from a user terminal, matching it with a database management system server session, transmitting the matching information to the database management system server, and transmitting web application server performance information to a performance information monitoring server.

In addition, in the web application monitoring and auditing system according to the present invention, it is characterized by including a connection information storage unit that stores user information in a web application server agent session from connection information received by connecting from a user terminal; a web application agent server performance information transmission unit that transmits web application server performance information stored in the web application server agent to a performance information monitoring server; and a web application server-database management system server session matching unit that, when a user connected to the web application server performs a database management system server task through an authorized web application server connection after the initial connection from the user terminal, transmits the user information stored in the session and the database management system server task content through the database management system server session to match the session information of the web application server and the database management system server session information.

In addition, in the web application monitoring and auditing system according to the present invention, the connection information storage unit is characterized by storing a user ID that is distinguished from other users as information of a user connecting to a web application server as session information of the web application server.

In addition, in the web application monitoring and auditing system according to the present invention, the database management system server is characterized in that it includes a database management system server agent for extracting audit information based on web application server session and database management system session matching information and transmitting the extracted audit information to an audit information management server, and transmitting database management system server performance information to a performance information monitoring server.

In addition, in the web application monitoring and auditing system according to the present invention, when a database operation is performed, the web application server agent is characterized in that it looks up a user ID within a web application server session to generate a transaction serial number and stores the user ID and transaction serial number as database management system session information.

In addition, in the web application monitoring and auditing system according to the present invention, the database management system server agent is characterized by including an audit information extraction unit that extracts user information and database management system server task content transmitted from the web application server agent when a change occurs in data stored as a database management system server task; an audit information transmission unit that transmits the audit information extracted and stored by the audit information extraction unit to an audit information management server; and a database management system server performance information transmission unit that transmits database management system server performance information stored in the database management system server agent to a performance information monitoring server.

In addition, in the web application monitoring and auditing system according to the present invention, the performance information monitoring server is characterized by including a performance information monitoring module and a performance information storage, including a performance information collection unit that receives web application server performance information stored in a web application server agent and database management system server performance information stored in a database management system server agent; a performance information management unit that classifies and organizes the web application server performance information and database management system server performance information received by the performance information collection unit and stores the same in a performance information storage; and a performance monitoring unit that processes monitoring to detect performance abnormalities compared to reference performance by searching the web application server performance information and the database management system server performance information.

In addition, in the web application monitoring and auditing system according to the present invention, the performance monitoring unit is characterized by detecting an IT system status abnormality such as exceeding a threshold specified by a user or being stopped or down, and notifying (alert) thereof.

In addition, in the web application monitoring and auditing system according to the present invention, the audit information management server is characterized by including an audit information monitoring module and an audit information storage, including an audit information collection unit that receives audit information extracted from a database management system server agent; an audit information management unit that collects data change information according to a database operation received from the audit information collection unit and organizes change history audit information and stores it in an audit information storage; and an audit monitoring unit that monitors violations of preset audit regulation criteria for data change information and audit information on change history collected and processed according to a database operation from the database management system server agent.

In addition, in the web application monitoring and auditing system according to the present invention, the audit monitoring unit is characterized by detecting violations of regulations pre-specified by the system administrator for collected audit information, and notifying the user when a violation is detected.

Meanwhile, a web application monitoring and auditing method according to the present invention comprises: a step in which a user terminal runs an application and connects to a web application server; a step in which a web application server agent collects a user ID from connection information; a step in which the web application server agent stores the collected user ID in a web application server session; a step in which the user terminal performs a database task through the web application server; a step in which the web application server agent searches for a user ID stored in the web application server session; a step in which the web application server agent generates a transaction serial number in response to a database task by the searched user ID; a step in which the web application server agent stores the user ID and the transaction serial number in a database management system server session; a step in which the web application server agent transmits processing information and the user ID serial number to a performance information monitoring server when the transaction task is terminated, and a step in which the database management system server agent transmits the processing information, the user ID, and the serial number to the performance information monitoring server and the audit information management server; And based on the processing information, user ID, and serial number, the audit information management server detects violations of audit regulation criteria and notifies the user when violations are detected, and the performance information monitoring server detects exceeding a threshold value pre-specified by the system administrator or detects abnormalities in the IT system status and notifies the user.

According to the present invention, when changing sensitive information within a company or organization, the exact subject of the change is recorded and stored, thereby providing a basis for analyzing the cause and clarifying the relationship of responsibility in the event of problems such as accounting fraud or embezzlement, and detecting cases of violations of designated rules and notifying or prohibiting them, thereby preventing accidents.

In addition, in the increasingly complex modern IT environment, it provides performance information linked to WAS and DBMS, thereby providing fast and accurate detection of IT system problems and supporting stable operation.

Figure 1 is an overall block diagram of a web application monitoring and auditing system according to the present invention.
Figure 2 is a detailed configuration diagram of the web application monitoring and auditing system illustrated in Figure 1.
Figure 3 is a block diagram according to the functions of the web application monitoring and auditing system illustrated in Figure 1.
Figure 4 is a flowchart illustrating a web application monitoring and auditing method according to the present invention.
Figures 5 and 6 are examples of program sources for storing a user ID in a login screen and a WAS session, respectively.
Figure 7 is an example of a program that transfers a user ID to a DBMS without changing the program.
Figure 8 shows an example of user ID information of WAS stored in a database session.

Hereinafter, a web application monitoring and auditing system and method according to an embodiment of the present invention will be described in detail with reference to the attached drawings.

FIG. 1 is an overall block diagram of a web application monitoring and auditing system according to the present invention, FIG. 2 is a detailed configuration diagram of the web application monitoring and auditing system illustrated in FIG. 1, and FIG. 3 is a block diagram according to the functions of the web application monitoring and auditing system illustrated in FIG. 1.

The present invention relates to a technology for monitoring application performance and managing data change history by linking session information of a web application server (hereinafter, WAS) and a database management system server (hereinafter, DBMS).

The web application performance monitoring and auditing system device through linking of WAS sessions and DBMS sessions is a device that matches WAS sessions and DBMS sessions related to specific transactions of WAS in a web-based structure including one or more WASs and one or more DBMSs to monitor performance and check whether data is manipulated.

Referring to FIG. 1, a web application monitoring and auditing system according to an embodiment of the present invention includes a user terminal (10), a web application server (WAS, 20), a database management system server (DBMS, 30), an audit information management server (40), and a performance information monitoring server (50).

The user terminal (10) runs a web application and connects to a web application server to process data changes.

The web application server (WAS, 20) runs applications, manages data input from web applications and connected user session information, and matches and stores session information of the web application server with session information of the database management system server.

The database management system server (DBMS, 30) extracts audit information from data change information based on database management system server session information that matches the session information of the web application server (WAS, 20).

Here, a database management system server (DBMS, 30) may be provided with a DBMS server storage (35) to manage and store database work contents and store database sessions.

The audit information management server (40) collects data change information from a database management system server (DBMS, 30) and stores the change history to monitor violations of preset audit regulation criteria for audit information.

Additionally, the audit information management server (40) may be connected to an audit information storage (45) that collects data change information and stores audit information from the change history.

The performance information monitoring server (50) collects web application performance information and database management system server performance information from a web application server (WAS, 20) and a database management system server (DBMS, 30) and monitors them against preset performance criteria.

Here, the performance information monitoring server (50) may be equipped with a performance information storage (55) that stores web application performance information and database management system server performance information collected from a web application server (WAS, 20) and a database management system server (DBMS, 30).

Referring to FIG. 2, the web application server (WAS, 20) includes a web application server agent (200).

The web application server agent (200) is for extracting and storing user access information connected to a web application server (WAS, 20) from a user terminal (10), matching it with a database management system server session, transmitting the matching information to a database management system server (DBMS, 30), and transmitting web application server performance information to a performance information monitoring server (50).

When a database operation is performed, the web application server agent (200) looks up the user ID within the web application server session to generate a transaction serial number and stores the user ID and transaction serial number as database management system session information.

The above web application server agent (200) includes a connection information storage unit (210), a web application agent server (WAS) performance information transmission unit (220), and a web application server-database management system server (WAS-DBMS) session matching unit (230).

The above connection information storage unit (210) connects from a user terminal (10) and stores user information in the web application server session from the connection information received.

In particular, the connection information storage unit (210) stores a user ID that distinguishes the user from other users as information on the user connecting to the web application server (WAS, 20) as session information of the web application server.

To this end, the user ID entered by the user in the login screen to access WAS is stored in the WAS session.

A WAS session is specific to a user and has unique characteristics that distinguish it from other users.

Figures 5 and 6 are examples of program sources for storing a user ID in a login screen and a WAS session, respectively.

The web application agent server (WAS) performance information transmission unit (220) transmits web application server performance information stored in the web application server agent to the performance information monitoring server (50).

When a user connected to the web application server (WAS, 20) performs a database management system server (DBMS, 30) task through an authorized web application server connection after the initial connection from a user terminal (10), the web application server-database management system server (WAS-DBMS) session matching unit (230) transmits the user information stored in the session and the database management system server (DBMS, 30) task content through the database management system server (DBMS, 30) session to match the session information of the web application server (WAS, 20) and the session information of the database management system server (DBMS, 30).

The WAS-DBMS session matching unit (230) of the WAS agent is characterized by transmitting the WAS user ID stored in the WAS session to the DBMS session in use to identify the user who performed the database record change.

The part that does this uses Java's weaving technology to minimize changes to the application.

Figure 7 is an example of a program source that transmits a user ID corresponding to the user ID that executed the task to the DBMS by weaving the ‘executeUpdate’ method that performs a database record change, and transmits the user ID to the DBMS without changing the program.

At this time, additional information, such as a transaction ID that indicates the serial number of the change along with the user ID, can be transmitted and used as a delimiter to distinguish each change.

This can be used as convenient information for monitoring overall transaction processing performance by quickly matching WAS processing and DBMS processing.

In FIG. 2, the database management system server (DBMS, 30) extracts audit information based on web application server session and database management system session matching information and transmits the extracted audit information to an audit information management server (40), and includes a database management system server agent (300) for transmitting database management system server performance information to a performance information monitoring server (50).

The above database management system server agent (300) transmits user information and changed database record information transmitted from the application server agent (200) to the audit information management server (40) and transmits related performance information to the performance information monitoring server (50).

The above database management system server agent (300) includes an audit information extraction unit (310), an audit information transmission unit (320), and a database management system server performance information transmission unit (330).

The gratitude information extraction unit (310) extracts user information and database management system server operation contents transmitted from the web application server agent (200) when a change occurs in data stored as a database management system server operation.

The extracted audit information consists of record information of the changed database and user ID information previously stored in the database session by the WAS-DBMS session matching unit (230).

Figure 8 shows an example of user ID information of WAS stored in a database session.

The audit information transmission unit (320) transmits the audit information extracted and stored by the audit information extraction unit (310) to the audit information management server (40).

The database management system server performance information transmission unit (330) transmits the database management system server performance information stored in the database management system server agent (300) to the performance information monitoring server (50).

Meanwhile, referring to FIG. 2, the audit information management server (40) includes an audit information management module (400), and the audit information management module (400) may be configured in software form.

The above audit information management module (400) includes an audit information collection unit (410), an audit information management unit (420), and an audit monitoring unit (430), and is connected to an audit information storage unit (45) that stores the collected audit information.

The audit information collection unit (410) receives audit information extracted from the database management system server agent (300).

The audit information management unit (420) collects data change information according to database work received from the audit information collection unit (310), organizes change history audit information, stores it in the audit information storage (45), and searches the stored information.

The audit monitoring unit (430) monitors violations of preset audit regulation criteria for data change information and audit information on change history collected and processed according to database operations from the database management system server agent (300).

The audit monitoring unit (430) detects violations of regulations pre-specified by the system administrator for collected audit information, and notifies (alerts) when violations are detected.

The audit monitoring unit (430) of the audit information management module detects violations of data change rules specified by the administrator and notifies of the same.

Change rules include segregation of duties, job description rules, etc. for access to, changes to, and other designated database records, as defined by regulations within a company or organization.

In addition, audit information stored in the audit information repository (55) can be used as data for internal audits of companies and organizations, such as accounting audits.

In addition, the performance information monitoring server (50) in FIG. 2 includes a performance information monitoring module (500), and the performance information monitoring module (500) can be configured in software form.

The above performance information monitoring module (500) includes a performance information collection unit (510), a performance information management unit (520), and a performance monitoring unit (530), stores, searches, and notifies abnormal signs of performance information of the WAS server and DBMS server, and is connected to a performance information storage unit (55) that stores the information.

The performance information collection unit (510) receives web application server performance information stored in the web application server agent (200) and database management system server performance information stored in the database management system server agent (300).

The performance information transmission unit (220) of the WAS agent and the performance information transmission unit (320) of the DBMS agent transmit WAS performance information, DBMS performance information, and information that can match them to the performance information monitoring server (50).

To match the two pieces of information, the user ID and transaction serial number stored in the DBMS session are used by the WAS-DBMS session matching unit (230).

The WAS performance information collected from the WAS agent (200) and the DBMS performance information collected from the DBMS agent (300) are transmitted from the WAS performance information transmission unit (220) and the DBMS performance information transmission unit (330) to the performance information collection unit (510) of the performance information monitoring module (500).

The performance information management unit (520) classifies and organizes the web application server performance information and database management system server performance information received from the performance information collection unit (510), stores the collected performance information in the performance information storage (55), and queries and monitors the collected performance information.

The performance monitoring unit (530) of the performance information monitoring module (500) performs integrated performance monitoring by matching the collected performance information based on the information recorded in the WAS-DBMS session matching unit (230).

The performance monitoring unit (530) processes monitoring to detect performance abnormalities compared to baseline performance for web application server performance information and database management system server performance information.

Performance anomaly detection is intended to detect abnormalities such as performance delays in WAS and DBMS, lack of resources such as CPU/memory, hangs, and downs.

The above performance monitoring unit (530) performs integrated performance monitoring by matching the collected performance information with the information recorded in the WAS-DBMS session matching unit (230).

Accordingly, the performance monitoring unit detects and alerts IT system status abnormalities such as exceeding a threshold specified by the user or being stopped or down.

Figure 3 is a block diagram according to the functions of the web application monitoring and auditing system illustrated in Figure 1, showing the processing order and data flow between each block.

Referring to Figure 3, the data processing order and data transmission flow proceed as follows.

A system user sends a connection request from a user terminal (10) to a WAS server (20).

At this time, the connection information storage unit (210) of the WAS agent (200) stores information about the user in the WAS session from the received connection information.

Afterwards, when a connected user performs a DBMS task through an authorized WAS connection, the WAS-DBMS session matching unit (230) of the WAS agent (200) transmits the user information and DBMS task content stored in the WAS session through the DBMS session. Through this, the WAS-DBMS session information is matched.

When a change occurs in data stored as a DBMS task received from a DBMS server (30), the audit information extraction unit (310) of the DBMS agent (300) extracts the user information and DBMS task content transmitted from the WAS-DBMS session matching unit (230), and the audit information transmission unit (320) transmits the extracted audit information to the audit information collection unit (410) of the audit information management module (400).

The audit information management module (400) collects and organizes the received audit information in the audit information management unit (420) and stores it.

Based on the collected audit information, the audit information monitoring unit (430) detects violations of specified regulations.

Additionally, the retained audit information can be used as data for internal audits of companies and organizations, such as accounting audits.

Figure 4 is a flow chart showing a web application monitoring and auditing method according to the present invention, showing a WAS session information and DBMS session information matching method and a data processing process.

As a first step, the user terminal (10) runs an application and connects to a web application server (WAS, 20) (S10).

The web application server agent (200) collects a user ID from the connection information, and the web application server agent (200) proceeds with the step of storing the collected user ID in the web application server session (S20, S30).

Thereafter, when the user terminal (10) performs a database task through the web application server (20) (S40), the web application server agent (200) searches for the user ID stored in the web application server session (S50).

The web application server agent (200) generates a transaction serial number in response to a database operation by the searched user ID (S60).

At this time, the web application server agent (200) stores the user ID and transaction serial number in the database management system server session (S70).

When a transaction task is completed, the web application server agent (200) transmits processing information, a user ID serial number to the performance information monitoring server (S80), and the database management system server agent (300) transmits processing information, a user ID, and a serial number to the performance information monitoring server (50) and the audit information management server (40) (S90).

Based on processing information, user ID, and serial number, the audit information management server (40) detects violations of audit regulation criteria and notifies (Alert) when violations are detected, and the performance information monitoring server (50) detects exceeding a threshold value pre-specified by a system administrator or an abnormality in the IT system status and notifies (Alert) of this (S100).

Although the present invention has been described in detail above only with respect to the described specific embodiments, it will be apparent to those skilled in the art that various modifications and variations are possible within the technical spirit of the present invention, and it is natural that such modifications and variations fall within the scope of the appended claims.

10: User terminal
20: Web Application Server (WAS)
200 : WAS Agent
210: Connection information storage unit 220: WAS performance information transmission unit
230: WAS-DBMS Session Matching Section
30: Database Management System Server (DBMS)
35: DBMS Server Storage
300 : DBMS Agent
310: Audit information extraction section 320: Audit information transmission section
330: DBMS performance information transmission section
40: Gratitude Information Management Server
45: Gratitude Information Repository
400: Gratitude Information Management Module
410: Audit Information Collection Department 420: Audit Information Management Department
430: Gratitude Monitoring Department
50: Performance Information Monitoring Server
55 : Performance Information Repository
500: Performance Information Monitoring Module
510: Performance Information Collection Department 520: Performance Information Management Department
530: Performance Monitoring Section

Claims (12)

In a system that monitors the performance of web applications by linking web application server session information and database management system server session information, and manages data change history to provide audit information,
A user terminal that runs a web application and connects to a web application server to process data changes;
A web application server that runs applications, manages data input from web applications and connected user session information, and matches and stores session information of the web application server with session information of the database management system server;
A database management system server that extracts audit information from data change information based on database management system server session information that matches the session information of a web application server;
A performance information monitoring server that collects and stores web application performance information and database management system server performance information from web application servers and database management system servers, and monitors the stored information by comparing it with preset performance criteria; and
A web application monitoring and auditing system including an audit information management server that collects data change information from a database management system server, stores the change history as audit information, and monitors violations of preset audit regulation criteria for the stored audit information. In paragraph 1,
A web application monitoring and auditing system characterized in that the web application server includes a web application server agent for extracting and storing user access information connected to the web application server from a user terminal, matching it with a database management system server session, transmitting the matching information to the database management system server, and transmitting web application server performance information to a performance information monitoring server. In the second paragraph,
A web application monitoring and auditing system, characterized in that when a database operation is performed, the web application server agent looks up the user ID within the web application server session to generate a transaction serial number and stores the user ID and transaction serial number as database management system session information. In the second paragraph,
The above web application server agent,
A connection information storage unit that stores user information in a web application server agent session from connection information received from a user terminal;
A web application agent server performance information transmission unit that transmits web application server performance information stored in a web application server agent to a performance information monitoring server; and
A web application monitoring and auditing system characterized by including a web application server-database management system server session matching unit that matches the session information of the web application server and the database management system server session information by transmitting the user information and the database management system server task content stored in the session through the database management system server session when a user connected to the web application server performs a database management system server task through an authorized web application server connection after the initial connection from a user terminal. In paragraph 4,
A web application monitoring and auditing system characterized in that the connection information storage unit stores the user ID that is distinguished from other users as information of a user connecting to a web application server as session information of the web application server. In paragraph 1,
A web application monitoring and auditing system, characterized in that the database management system server extracts audit information based on web application server session and database management system session matching information and transmits the extracted audit information to an audit information management server, and includes a database management system server agent for transmitting database management system server performance information to a performance information monitoring server. In paragraph 5,
The above database management system server agent,
An audit information extraction unit that extracts user information and database management system server operation content transmitted from a web application server agent when a change occurs in stored data due to a database management system server operation;
An audit information transmission unit that transmits audit information extracted and stored in an audit information extraction unit to an audit information management server; and
A web application monitoring and auditing system, characterized by including a database management system server performance information transmission unit that transmits database management system server performance information stored in a database management system server agent to a performance information monitoring server. In paragraph 1,
The above performance information monitoring server,
A performance information collection unit that receives web application server performance information stored in a web application server agent and database management system server performance information stored in a database management system server agent;
A performance information management unit that classifies and organizes web application server performance information and database management system server performance information received from a performance information collection unit and stores them in a performance information storage; and
A web application monitoring and auditing system characterized by including a performance information monitoring module including a performance monitoring unit that processes monitoring to detect performance abnormalities compared to baseline performance by querying web application server performance information and database management system server performance information, and a performance information storage. In Article 8,
A web application monitoring and auditing system characterized by detecting and notifying of IT system status abnormalities such as exceeding a threshold specified by a user or being stopped or down. In paragraph 1,
The above gratitude information management server,
An audit information collection unit that receives audit information extracted from a database management system server agent;
An audit information management unit that collects data change information according to database operations received from the audit information collection unit and organizes change history audit information and stores it in an audit information storage; and
A web application monitoring and auditing system characterized by including an audit information monitoring module including an audit monitoring unit that monitors violations of preset audit regulation criteria for data change information and audit information on change history collected and processed according to database operations from a database management system server agent, and an audit information storage. In Article 10,
A web application monitoring and auditing system characterized in that the audit monitoring unit detects violations of regulations pre-specified by the system administrator for collected audit information and notifies the user when a violation is detected. A step in which a user terminal runs an application and connects to a web application server;
The web application server agent collects the user ID from the connection information;
The web application server agent stores the collected user ID in the web application server session;
A step in which a user terminal performs a database operation through a web application server;
The web application server agent looks up the user ID stored in the web application server session;
The web application server agent generates a transaction serial number in response to a database operation by the retrieved user ID;
The web application server agent stores the user ID and transaction serial number in the database management system server session;
The web application server agent transmits processing information and a user ID serial number to the performance information monitoring server when the transaction task is completed, and the database management system server agent transmits processing information, a user ID, and a serial number to the performance information monitoring server and the audit information management server; and
A web application monitoring and auditing method characterized in that it includes a step in which an audit information management server detects violations of audit regulation criteria based on processing information, a user ID, and a serial number, and notifies the user when a violation is detected, and a performance information monitoring server detects and notifies the user when a threshold specified in advance by a system administrator is exceeded or an IT system status is abnormal.